KumiSystems/openwrtv3
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
openwrtv3/target/linux/ipq40xx/image/Makefile
Christian Lamparter 82618062cf ipq40xx: add support for the ZyXEL NBG6617 
This patch adds support for ZyXEL NBG6617

Hardware highlights:

SOC:    IPQ4018 / QCA Dakota
CPU:    Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7
DRAM:   256 MiB DDR3L-1600/1866 Nanya NT5CC128M16IP-DI @ 537 MHz
NOR:    32 MiB Macronix MX25L25635F
ETH:    Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN)
USB:    1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC)
WLAN1:  Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2
WLAN2:  Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2
INPUT:  RESET Button, WIFI/Rfkill Togglebutton, WPS Button
LEDS:   Power, WAN, LAN 1-4, WLAN 2.4GHz, WLAN 5GHz, USB, WPS

Serial:
	WARNING: The serial port needs a TTL/RS-232 3.3v level converter!
	The Serial setting is 115200-8-N-1. The 1x4 .1" header comes
	pre-soldered. Pinout:
	  1. 3v3 (Label printed on the PCB), 2. RX, 3. GND, 4. TX

first install / debricking / restore stock:
 0. Have a PC running a tftp-server @ 192.168.1.99/24
 1. connect the PC to any LAN-Ports
 2. put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file
    into the tftp-server root directory and rename it to just "ras.bin".
 3. power-cycle the router and hold down the the WPS button (for 30sek)
 4. Wait (for a long time - the serial console provides some progress
    reports. The u-boot says it best: "Please be patient".
 5. Once the power LED starts to flashes slowly and the USB + WPS LEDs
    flashes fast at the same time. You have to reboot the device and
    it should then come right up.

Installation via Web-UI:
 0. Connect a PC to the powered-on router. It will assign your PC a
    IP-address via DHCP
 1. Access the Web-UI at 192.168.1.1 (Default Passwort: 1234)
 2. Go to the "Expert Mode"
 3. Under "Maintenance", select "Firmware-Upgrade"
 4. Upload the OpenWRT factory image
 5. Wait for the Device to finish.
    It will reboot into OpenWRT without any additional actions needed.

To open the ZyXEL NBG6617:
 0. remove the four rubber feet glued on the backside
 1. remove the four philips screws and pry open the top cover
    (by applying force between the plastic top housing from the
    backside/lan-port side)

Access the real u-boot shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:

|   Hit any key to stop autoboot:  3

The user is then dropped to a locked shell.

|NBG6617> HELP
|ATEN    x[,y]     set BootExtension Debug Flag (y=password)
|ATSE    x         show the seed of password generator
|ATSH              dump manufacturer related data in ROM
|ATRT    [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
|ATGO              boot up whole system
|ATUR    x         upgrade RAS image (filename)
|NBG6617>

In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!

First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.

|NBG6617> ATSE NBG6617
|012345678901

This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):

- tool.sh -
ror32() {
  echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -

|# bash ./tool.sh 012345678901
|
|ATEN 1,879C711

copy and paste the result into the shell to unlock zloader.

|NBG6617> ATEN 1,0046B0017430

If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.

|NBG6617> ATGU
|NBG6617#

Co-authored-by: David Bauer <mail@david-bauer.net>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: David Bauer <mail@david-bauer.net>
2018-06-26 08:57:26 +02:00

241 lines
7.8 KiB
Makefile
Raw Blame History

include $(TOPDIR)/rules.mk
include $(INCLUDE_DIR)/image.mk
DEVICE_VARS += RAS_BOARD RAS_ROOTFS_SIZE RAS_VERSION
define Device/Default
PROFILES := Default
KERNEL_DEPENDS = $$(wildcard $(DTS_DIR)/$$(DEVICE_DTS).dts)
KERNEL_INITRAMFS_PREFIX := $$(IMG_PREFIX)-$(1)-initramfs
KERNEL_PREFIX := $$(IMAGE_PREFIX)
KERNEL_LOADADDR := 0x80208000
SUPPORTED_DEVICES := $(subst _,$(comma),$(1))
IMAGE/sysupgrade.bin = sysupgrade-tar | append-metadata
IMAGE/sysupgrade.bin/squashfs :=
endef
define Device/FitImage
KERNEL_SUFFIX := -fit-uImage.itb
KERNEL = kernel-bin | gzip | fit gzip $$(DTS_DIR)/$$(DEVICE_DTS).dtb
KERNEL_NAME := Image
endef
define Device/FitImageLzma
KERNEL_SUFFIX := -fit-uImage.itb
KERNEL = kernel-bin | lzma | fit lzma $$(DTS_DIR)/$$(DEVICE_DTS).dtb
KERNEL_NAME := Image
endef
define Device/UbiFit
KERNEL_IN_UBI := 1
IMAGES := nand-factory.ubi nand-sysupgrade.bin
IMAGE/nand-factory.ubi := append-ubi
IMAGE/nand-sysupgrade.bin := sysupgrade-tar | append-metadata
endef
define Device/DniImage
KERNEL_SUFFIX := -fit-uImage.itb
KERNEL = kernel-bin | gzip | fit gzip $$(DTS_DIR)/$$(DEVICE_DTS).dtb
KERNEL_NAME := Image
NETGEAR_BOARD_ID :=
NETGEAR_HW_ID :=
IMAGES := factory.img sysupgrade.bin
IMAGE/factory.img := append-kernel | pad-offset 64k 64 | append-uImage-fakehdr filesystem | pad-to $$$$(KERNEL_SIZE) | append-rootfs | pad-rootfs | netgear-dni
IMAGE/sysupgrade.bin := append-kernel | pad-offset 64k 64 | append-uImage-fakehdr filesystem | pad-to $$$$(KERNEL_SIZE) | append-rootfs | pad-rootfs | append-metadata
endef
DEVICE_VARS += NETGEAR_BOARD_ID NETGEAR_HW_ID
define Device/8dev_jalapeno
$(call Device/FitImage)
$(call Device/UbiFit)
DEVICE_DTS := qcom-ipq4018-jalapeno
BLOCKSIZE := 128k
PAGESIZE := 2048
DEVICE_TITLE := 8devices Jalapeno
endef
TARGET_DEVICES += 8dev_jalapeno
define Device/asus_rt-ac58u
$(call Device/FitImageLzma)
DEVICE_DTS := qcom-ipq4018-rt-ac58u
BLOCKSIZE := 128k
PAGESIZE := 2048
DTB_SIZE := 65536
DEVICE_TITLE := Asus RT-AC58U
IMAGE_SIZE := 20439364
FILESYSTEMS := squashfs
# Someone - in their infinite wisdom - decided to put the firmware
# version in front of the image name \03\00\00\04 => Version 3.0.0.4
# Since u-boot works with strings we either need another fixup step
# to add a version... or we are very careful not to add '\0' into that
# string and call it a day.... Yeah, we do the latter!
UIMAGE_NAME:=$(shell echo -e '\03\01\01\01RT-AC58U')
IMAGES := sysupgrade.bin
DEVICE_PACKAGES := kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += asus_rt-ac58u
define Device/avm_fritzbox-4040
$(call Device/FitImageLzma)
DEVICE_DTS := qcom-ipq4018-fritz4040
BOARD_NAME := fritz4040
DEVICE_TITLE := AVM Fritz!Box 4040
IMAGE_SIZE := 29753344
UBOOT_PATH := $$(BIN_DIR)/u-boot-fritz4040/uboot-fritz4040.bin
UBOOT_PARTITION_SIZE := 524288
IMAGES = eva.bin sysupgrade.bin
IMAGE/eva.bin := append-uboot | pad-to $$$$(UBOOT_PARTITION_SIZE) | append-kernel | append-rootfs | pad-rootfs
IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
DEVICE_PACKAGES := fritz-tffs fritz-caldata u-boot-fritz4040
endef
TARGET_DEVICES += avm_fritzbox-4040
define Device/compex_wpj428
$(call Device/FitImage)
DEVICE_DTS := qcom-ipq4028-wpj428
DEVICE_DTS_CONFIG := config@4
BLOCKSIZE := 64k
DEVICE_TITLE := Compex WPJ428
IMAGE_SIZE := 31232k
KERNEL_SIZE := 4096k
IMAGES = sysupgrade.bin
IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
DEVICE_PACKAGES := kmod-gpio-beeper
endef
TARGET_DEVICES += compex_wpj428
define Device/glinet_gl-b1300
$(call Device/FitImage)
DEVICE_TITLE := GL.iNet GL-B1300
BOARD_NAME := gl-b1300
DEVICE_DTS := qcom-ipq4029-gl-b1300
KERNEL_SIZE := 4096k
IMAGE_SIZE := 26624k
IMAGES := sysupgrade.bin
IMAGE/sysupgrade.bin := append-kernel |append-rootfs | pad-rootfs | append-metadata
endef
TARGET_DEVICES += glinet_gl-b1300
define Device/meraki_mr33
$(call Device/FitImage)
DEVICE_DTS := qcom-ipq4029-mr33
BLOCKSIZE := 131072
PAGESIZE := 2048
DEVICE_TITLE := Cisco Meraki MR33
IMAGES = sysupgrade.bin
DEVICE_PACKAGES := -swconfig ath10k-firmware-qca9887
endef
TARGET_DEVICES += meraki_mr33
define Device/netgear_ex61x0v2
$(call Device/DniImage)
KERNEL_SIZE := 3080192
DEVICE_DTS_CONFIG := config@4
NETGEAR_BOARD_ID := EX6150v2series
NETGEAR_HW_ID := 29765285+16+0+128+2x2
endef
define Device/netgear_ex6100v2
$(call Device/netgear_ex61x0v2)
DEVICE_DTS := qcom-ipq4018-ex6100v2
DEVICE_TITLE := Netgear EX6100v2
endef
TARGET_DEVICES += netgear_ex6100v2
define Device/netgear_ex6150v2
$(call Device/netgear_ex61x0v2)
DEVICE_DTS := qcom-ipq4018-ex6150v2
DEVICE_TITLE := Netgear EX6150v2
endef
TARGET_DEVICES += netgear_ex6150v2
define Device/openmesh_a42
$(call Device/FitImageLzma)
DEVICE_DTS := qcom-ipq4018-a42
DEVICE_DTS_CONFIG := config@om.a42
BLOCKSIZE := 64k
DEVICE_TITLE := OpenMesh A42
KERNEL = kernel-bin | lzma | fit lzma $$(DTS_DIR)/$$(DEVICE_DTS).dtb | pad-to $$(BLOCKSIZE)
IMAGE_SIZE := 15616k
IMAGES = factory.bin sysupgrade.bin
IMAGE/factory.bin := append-rootfs | pad-rootfs | openmesh-image ce_type=A42
IMAGE/sysupgrade.bin/squashfs := append-rootfs | pad-rootfs | sysupgrade-tar rootfs=$$$$@ | append-metadata
DEVICE_PACKAGES := uboot-envtools
endef
TARGET_DEVICES += openmesh_a42
define Device/openmesh_a62
$(call Device/FitImageLzma)
DEVICE_DTS := qcom-ipq4019-a62
DEVICE_DTS_CONFIG := config@om.a62
BLOCKSIZE := 64k
DEVICE_TITLE := OpenMesh A62
KERNEL = kernel-bin | lzma | fit lzma $$(DTS_DIR)/$$(DEVICE_DTS).dtb | pad-to $$(BLOCKSIZE)
IMAGE_SIZE := 15552k
IMAGES = factory.bin sysupgrade.bin
IMAGE/factory.bin := append-rootfs | pad-rootfs | openmesh-image ce_type=A62
IMAGE/sysupgrade.bin/squashfs := append-rootfs | pad-rootfs | sysupgrade-tar rootfs=$$$$@ | append-metadata
DEVICE_PACKAGES := ath10k-firmware-qca9888 uboot-envtools
endef
TARGET_DEVICES += openmesh_a62
define Device/qcom_ap-dk01.1-c1
DEVICE_TITLE := QCA AP-DK01.1-C1
BOARD_NAME := ap-dk01.1-c1
DEVICE_DTS := qcom-ipq4019-ap.dk01.1-c1
KERNEL_INSTALL := 1
KERNEL_SIZE := 4096k
IMAGE_SIZE := 26624k
$(call Device/FitImage)
IMAGES := sysupgrade.bin
IMAGE/sysupgrade.bin := append-kernel | pad-to $$$${KERNEL_SIZE} | append-rootfs | pad-rootfs | append-metadata
endef
TARGET_DEVICES += qcom_ap-dk01.1-c1
define Device/qcom_ap-dk04.1-c1
$(call Device/FitImage)
$(call Device/UbiFit)
DEVICE_DTS := qcom-ipq4019-ap.dk04.1-c1
KERNEL_INSTALL := 1
KERNEL_SIZE := 4048k
BLOCKSIZE := 128k
PAGESIZE := 2048
BOARD_NAME := ap-dk04.1-c1
DEVICE_TITLE := QCA AP-DK04.1-C1
endef
TARGET_DEVICES += qcom_ap-dk04.1-c1
define Device/zyxel_nbg6617
$(call Device/FitImageLzma)
DEVICE_DTS := qcom-ipq4018-nbg6617
DEVICE_TITLE := ZyXEL NBG6617
ROOTFS_SIZE := 24960k
RAS_BOARD := NBG6617
RAS_ROOTFS_SIZE := 19840k
RAS_VERSION := "$(VERSION_DIST) $(REVISION)"
IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
IMAGES := sysupgrade.bin factory.bin
# The ZyXEL firmware allows flashing thru the web-gui only when the rootfs is
# at least as large as the one of the initial firmware image (not the current
# one on the device). This only applies to the Web-UI, the bootlaoder ignores
# this minimum-size. However, the larger image can be flashed both ways.
IMAGE/factory.bin := append-rootfs | pad-rootfs | check-size $$$$(ROOTFS_SIZE) | make-ras
IMAGE/sysupgrade.bin/squashfs := append-rootfs | pad-rootfs | check-size $$$$(ROOTFS_SIZE) | sysupgrade-tar rootfs=$$$$@ | append-metadata
DEVICE_PACKAGES := ipq-wifi-zyxel_nbg6617 uboot-envtools
endef
TARGET_DEVICES += zyxel_nbg6617
define Device/zyxel_wre6606
$(call Device/FitImage)
DEVICE_TITLE := ZyXEL WRE6606
DEVICE_DTS_CONFIG := config@4
DEVICE_DTS := qcom-ipq4018-wre6606
DEVICE_PACKAGES := ipq-wifi-zyxel_wre6606
IMAGES := sysupgrade.bin
IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
endef
TARGET_DEVICES += zyxel_wre6606
$(eval $(call BuildImage))
Reference in a new issue View git blame Copy permalink